Uploaded image for project: 'Node.js Driver'
  1. Node.js Driver
  2. NODE-4297

upgrade kerberos dependency to use only ansi-regex ^6.0.1 due to Security Vulnerability

    XMLWordPrintableJSON

Details

    • Task
    • Status: Closed
    • Unknown
    • Resolution: Done
    • kerberos-1.1.7, kerberos-2.0.0
    • kerberos-2.0.1
    • None
    • 2
    • Not Needed

    Description

      Summary

      Security Vulnerabilities in kerberos 2.0.0

      This vulnerability comes from ansi-regex@2.1.1, which is a transitive dependency.
      the solution is to upgrade depndency 

      Motivation

      How does this affect the end user?

      Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns{{ [\\]()#;?}} and (?:;[-a-zA-Z\\d\\/#&.:=?%@~_])*.

      Is this issue urgent?

      yes, possible ReDoS

       

       

      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807

      Attachments

        Issue Links

          Activity

            People

              neal.beeken@mongodb.com Neal Beeken
              moscovih@post.bgu.ac.il Hadas Moscovici
              Neal Beeken
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: